com php-src: Fixed bug #65382 (Segfault in closure_030 .phpt): Zend/zend_vm_def.h Zend/zend_vm_exe cute.h
| From: | Dmitry Stogov | Date: | Mon, 12 Aug 2013 06:53:20 +0000 |
| Subject: | com php-src: Fixed bug #65382 (Segfault in closure_030 .phpt): Zend/zend_vm_def.h Zend/zend_vm_exe cute.h | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-72919@lists.php.net to get a copy of this message | ||
Commit: 52dac3e8cda94c8f38287ec3c437d9450b31b527
Author: Dmitry Stogov <dmitry@zend.com> Mon, 12 Aug 2013 10:53:20 +0400
Parents: 3ada3aaea65bdfa11d6a70040ea7c63f7020d0ef
Branches: master
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=52dac3e8cda94c8f38287ec3c437d9450b31b527
Log:
Fixed bug #65382 (Segfault in closure_030.phpt)
Bugs:
https://bugs.php.net/65382
Changed paths:
M Zend/zend_vm_def.h
M Zend/zend_vm_execute.h
Diff:
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 19b1ff6..027b667 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2684,7 +2684,7 @@ ZEND_VM_HANDLER(59, ZEND_INIT_FCALL_BY_NAME, ANY, CONST|TMP|VAR|CV)
if (call->object) {
Z_ADDREF_P(call->object);
}
- if (OP2_TYPE == IS_VAR && OP2_FREE &&
+ if (OP2_TYPE == IS_VAR && OP2_FREE && Z_REFCOUNT_P(function_name) == 1
&&
call->fbc->common.fn_flags & ZEND_ACC_CLOSURE) {
/* Delay closure destruction until its invocation */
call->fbc->common.prototype = (zend_function*)function_name;
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index a3e88cd..c8214b8 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -1267,7 +1267,7 @@ static int ZEND_FASTCALL
ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER(ZEND_OPCODE
if (call->object) {
Z_ADDREF_P(call->object);
}
- if (IS_CONST == IS_VAR && 0 &&
+ if (IS_CONST == IS_VAR && 0 && Z_REFCOUNT_P(function_name) == 1 &&
call->fbc->common.fn_flags & ZEND_ACC_CLOSURE) {
/* Delay closure destruction until its invocation */
call->fbc->common.prototype = (zend_function*)function_name;
@@ -1592,7 +1592,7 @@ static int ZEND_FASTCALL
ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER(ZEND_OPCODE_H
if (call->object) {
Z_ADDREF_P(call->object);
}
- if (IS_TMP_VAR == IS_VAR && 1 &&
+ if (IS_TMP_VAR == IS_VAR && 1 && Z_REFCOUNT_P(function_name) == 1 &&
call->fbc->common.fn_flags & ZEND_ACC_CLOSURE) {
/* Delay closure destruction until its invocation */
call->fbc->common.prototype = (zend_function*)function_name;
@@ -1779,7 +1779,7 @@ static int ZEND_FASTCALL
ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER(ZEND_OPCODE_H
if (call->object) {
Z_ADDREF_P(call->object);
}
- if (IS_VAR == IS_VAR && (free_op2.var != NULL) &&
+ if (IS_VAR == IS_VAR && (free_op2.var != NULL) && Z_REFCOUNT_P(function_name) ==
1 &&
call->fbc->common.fn_flags & ZEND_ACC_CLOSURE) {
/* Delay closure destruction until its invocation */
call->fbc->common.prototype = (zend_function*)function_name;
@@ -2004,7 +2004,7 @@ static int ZEND_FASTCALL
ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER(ZEND_OPCODE_HA
if (call->object) {
Z_ADDREF_P(call->object);
}
- if (IS_CV == IS_VAR && 0 &&
+ if (IS_CV == IS_VAR && 0 && Z_REFCOUNT_P(function_name) == 1 &&
call->fbc->common.fn_flags & ZEND_ACC_CLOSURE) {
/* Delay closure destruction until its invocation */
call->fbc->common.prototype = (zend_function*)function_name;